A group of researchers discovered another previously undisclosed cyberattack by agents Open AI was testing. The agents, which the company was testing in a supposed sandbox environment, reportedly broke into Ruby Gems, a community-ran packaging service for Ruby programs and libraries. According to The Wall Street Journal, the attacks on Ruby Gems started on May 11, two months before Hugging Face.

The agents created accounts every two to three minutes and then uploaded hundreds of files to the service. Ruby Gems had to shut down account registration for four days in order to stop the attacks. The agents' documents contained web pages scraped from the internet instead of code, including online calendars from a UK government website.

The swarm of agents didn't try to hide their activities either and used "OAI" in their file names, as well as terms like "hack," "evil" and "exploit." Researchers told The Journal that the agents tried to exploit a couple of bugs, one of which was a zero-day vulnerability, in an attempt to publish existing files on the service that belonged to other users.

A spokesperson for Open AI told the Journal that its agents used the Ruby Gems platform to access the internet to carry out benign tasks and retrieve public information. The company added that it will continue to investigate as part of its broader review of agent activity during training and evaluation.